MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MedusaStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149
SHA3-384 hash:	03135a191d191d9e00456ac68119a4e9366f6e5707952ce5e1bad72dc143e82fa58f32aa4b78a5c5ac6556292e722484
SHA1 hash:	92d27f9a7b2c8ef52e96903d58830f5f441fa3d2
MD5 hash:	f1fec815d89e12b6214a62a5a0be2f04
humanhash:	emma-crazy-hamper-finch
File name:	f1fec815d89e12b6214a62a5a0be2f04
Download:	download sample
Signature	MedusaStealer Create hunting rule
File size:	683'008 bytes
First seen:	2023-06-16 11:14:58 UTC
Last seen:	2023-06-16 14:28:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	055b7f3bc7ff14f379a5a350e33b08c1 (1 x MedusaStealer)
ssdeep	12288:10Vzuj87ZA9O8Qdhu5QU2ajd0YPThtY0AZzSoFyhaUv:KVs8i5QFUXjyYjY0AZec
Threatray	3 similar samples on MalwareBazaar
TLSH	T1FCE42931E69C32ADC16A9078FD0B5C13E626789E1321BFEB12D45A521F66EE05F3D360
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	64 exe MedusaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

324

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f1fec815d89e12b6214a62a5a0be2f04

Verdict:

Malicious activity

Analysis date:

2023-06-16 11:15:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f319031a-171e-4958-af61-201808fffc39

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/399446/

Detection(s):

SecuriteInfo.com.Win64.Trojan-gen.9833.15397.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a window

Reading critical registry keys

Stealing user critical data

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/91027/overview

Behaviour

MalwareBazaar

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Tags:

crypto greyware lolbin shell32.dll

Link:

https://www.filescan.io/uploads/648c4437fad28f3c32b684af/reports/411228a4-d8bc-45c2-8f10-ee5b3212c565/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/04f467b1-7e5b-4d17-9d79-85d1cbc39a70

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1255993

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149/

Threat name:

Win64.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-06-16 11:15:07 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=flmex77x2usx7xvydnfvfohacfpsn2hazwvact46gccpkgfkmfeq._file

Verdict:

malicious

MedusaStealer

d599e1de51559b043affc9a52cf274ff677698df499bff1a6708e1fb8d1b2b41

MedusaStealer

f0c730ae57d07440a0de0889db93705c1724f8c3c628ee16a250240cc4f91858

MedusaStealer

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230616-ncjtdsef74/

Behaviour

Modifies system certificate store

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149

MD5 hash:

f1fec815d89e12b6214a62a5a0be2f04

SHA1 hash:

92d27f9a7b2c8ef52e96903d58830f5f441fa3d2

Link:

https://www.unpac.me/results/c6bbe60f-82f5-495e-983a-4d714826ed31/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2ad84bfff7d5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com